CVE-2026-120415 · Package
NO FIX YET · SEE WHAT TO DO
undici, the HTTP client built into Node.js, fails to strip Authorization and Cookie headers on cross-origin redirects when headers are passed as an array of tuples. When a cache or deduplicate interceptor sits outside the redirect interceptor, those credentials are sent to the redirect destination.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use undici's request API with header arrays of name and value tuples, and that follow redirects with the cache or deduplicate interceptor composed outside the redirect interceptor. Code that passes headers as a plain object or a flat array, or that composes the redirect interceptor outside the normalizing interceptor, is not exposed.
Not affected if flat-header-array, plain-object-headers, redirect-interceptor-outermost
Who cares http-client, node.js, undici
npm ls undici to find undici versions in the project tree7.0.0 through 7.30.1 or 8.0.0 through 8.12.37.30.2undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied as an array of name and value tuples (a valid documented input, for example from Object.entries), the redirect handler misreads them as a flat list so the header names never match and the sensitive headers are not removed. If a header-normalizing interceptor such as cache or deduplicate is composed outside the redirect interceptor, it then serializes the retained headers onto the cross-origin request, disclosing the caller's origin-bound credentials to the unrelated redirect destination. This is a representation-dependent bypass of the cross-origin header stripping added in CVE-2024-30260. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply request headers as a plain object or a flat name and value array rather than an array of tuples, or compose the redirect interceptor outside the normalizing interceptor.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
8.12.4NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.